From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Oscar Deschamps <odeschamps.mail@gmail.com>
Cc: joaomarcos.costa@bootlin.com, richard.genoud@bootlin.com,
trini@konsulko.com, thomas.petazzoni@bootlin.com,
u-boot@lists.u-boot-project.org
Subject: Re: [PATCH] fs/squashfs: fix NULL dereference on empty-directory lookup
Date: Fri, 30 Oct 2026 10:25:31 +0100 [thread overview]
Message-ID: <87bj8bee0k.fsf@bootlin.com> (raw)
In-Reply-To: <20261029153940.461197-1-odeschamps.mail@gmail.com> (Oscar Deschamps's message of "Thu, 29 Oct 2026 16:39:40 +0100")
On 29/10/2026 at 16:39:40 +01, Oscar Deschamps <odeschamps.mail@gmail.com> wrote:
> The three directory-search loops in sqfs.c use the local `ret` to tell
> whether the requested name was found. When the loop runs zero times
> `ret` keeps the 0 left by the preceding sqfs_opendir_nest(),
> so the "not found" check is skipped and the NULL dirs->entry
> is dereferenced (dirs->entry->inode_offset). A crafted or corrupted image
> can thus crash U-Boot (a NULL read) while resolving,
> reading or sizing a path.
>
> Treat a loop that produced no entry as "not found" in sqfs_search_dir(),
> sqfs_read_nest() and sqfs_size_nest(). Found by fuzzing the SquashFS
> parser.
>
> Signed-off-by: Oscar Deschamps <odeschamps.mail@gmail.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
prev parent reply other threads:[~2026-10-30 13:00 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-29 15:39 [PATCH] fs/squashfs: fix NULL dereference on empty-directory lookup Oscar Deschamps
2026-10-30 9:25 ` Miquel Raynal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87bj8bee0k.fsf@bootlin.com \
--to=miquel.raynal@bootlin.com \
--cc=joaomarcos.costa@bootlin.com \
--cc=odeschamps.mail@gmail.com \
--cc=richard.genoud@bootlin.com \
--cc=thomas.petazzoni@bootlin.com \
--cc=trini@konsulko.com \
--cc=u-boot@lists.u-boot-project.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.